Personal Information Protection Commission: "Kakao Fine Imposed According to Changed Concept"

Kakao Fined 15.1 Billion KRW for Personal Data Leak
Highest Amount Among Domestic Companies... "Principle and Law Applied to Similar Cases"

Choi Jang-hyuk, Vice Chairman of the Personal Information Protection Commission, is speaking at the regular briefing on the 5th.
[Photo by Personal Information Protection Commission]

Choi Jang-hyuk, Vice Chairman of the Personal Information Protection Commission, stated regarding the imposition of the largest fine on a domestic company, Kakao, due to negligence in checking user information, "The concept of personal information is changing, and the judgment was made accordingly."

According to the Personal Information Protection Commission on the 6th, Vice Chairman Choi explained at a regular briefing the day before, "It is difficult to accept the claim that the serial number is not personal information in the context of the evolving concept of personal information," adding, "The same principles and laws were applied as in similar cases."

He continued, "If personal information can be sufficiently identified by combining it with external information, it is included as personal information," and warned, "There is a concern that an obsession with a narrow concept of personal information could lead to inadequate protection."

Earlier, the Personal Information Protection Commission imposed a fine of approximately 15.1 billion KRW, the largest among domestic companies, on Kakao for negligence in inspecting and protecting user information, which led to the leakage of about 65,000 personal information records. It was also confirmed that information of 696 users of KakaoTalk open chat rooms was posted on a specific site.

The Commission viewed that Kakao did not encrypt the temporary IDs of open chat room participants, making it easy to identify member serial numbers. The member serial number is information used solely for management within KakaoTalk and is a concept similar to a unique number assigned to an individual, such as a resident registration number or employee ID number.

In response, Kakao argued, "Member serial numbers and temporary IDs are essential information for providing all online and mobile services, including messenger," and "They are numeric strings that do not contain any personal information and cannot be used to identify individuals."

They further emphasized, "Service serial numbers generated by the business operator are not subject to encryption under relevant laws, so not encrypting them cannot be considered a violation of the law." Kakao plans to actively consider responses such as administrative lawsuits.

Additionally, the Personal Information Protection Commission imposed a fine of 7.8 million KRW for violations of safety measures and breach of reporting and notification obligations. A Commission official stated, "Kakao did not individually notify the 696 users whose personal information was leaked," and "No reports of personal information leakage have been filed with the Commission."

Following the imposition of the largest fine on Kakao among domestic companies, concerns have been raised in the industry that corporate activities might be restrained. Previously, Golfzon, which leaked the names and phone numbers of about 2.21 million people, was fined the largest amount of 7.54 billion KRW. LG Uplus was also fined 6.8 billion KRW for leaking about 300,000 customer information records externally.

Regarding the amount of the fine, Vice Chairman Choi said, "Although KakaoTalk is a free service, the related revenue was high, which led to this scale of fine."

Meanwhile, Vice Chairman Choi revealed that investigations are underway targeting violations of personal information laws by Chinese online shopping malls such as AliExpress and Temu, with the aim of announcing results by the end of this month.

Regarding the Line Yahoo personal information leakage incident and an email from the Japanese Personal Information Protection Commission inquiring about cooperation in investigating Naver, he said, "It was just a brief contact between officials, and there is no obligation to respond," adding, "Given the complex Korea-Japan relations, I question whether further action is necessary."

This content was produced with the assistance of AI translation services.